Bump flatted from 3.3.3 to 3.4.2

[dependabot]

Bumps flatted from 3.3.3 to 3.4.2.

Commits

• 3bf0909 3.4.2
• 885ddcc fix CWE-1321
• 0bdba70 added flatted-view to the benchmark
• 2a02dce 3.4.1
• fba4e8f Merge pull request #89 from WebReflection/python-fix
• 5fe8648 added "when in Rome" also a test for PHP
• 53517ad some minor improvement
• b3e2a0c Fixing recursion issue in Python too
• c4b46db Add SECURITY.md for security policy and reporting
• f86d071 Create dependabot.yml for version updates
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[MarcLevyTO]

🤖 Dependabot cleanup pass — verified & ready to merge (needs a maintainer)

I verified this flatted 3.3.3 → 3.4.2 bump (dev-only transitive dep, lockfile-only): npm ci resolves and the CI check (npm run check = eslint + prettier) passes at parity with the base branch. Bonus: it clears a high-severity advisory in the old flatted.

Next step: a maintainer with write access can merge this — it's a clean bump and its checks are green. (I ran this as part of a batch review of open Dependabot minor/patch PRs and confirmed it, but I only have read access to this repo, so I couldn't merge it myself.)

[ilteoood]

@ryan-roemer what about merging this and moving the repo to read-only?
So that no new PRs are opened.

[ryan-roemer]

haha, I'm actually active in branches in this one -- https://github.com/nearform/web-agents/branches

I'm going to present this at AGNTCon in a few weeks alongside other demos.

The dependabot things I think I'm going to just pause. This repo has only CDN ESM dependencies and is a pure frontend app. Like the security issue noted in flatted would require accepting untrusted input.

[ryan-roemer]

I just manually did the npm deps and pushed to main.

I'm not tackling the frontend deps right now because I need to validate the @mcp-b/* deps against a number of different demos I'm doing...

$ npx importmap-check public/index.html 
importmap-check
Target: public/index.html

## Updates
Package                   | Resolved | Latest
------------------------- | -------- | ------
@mcp-b/transports         | 5.1.0    | 6.0.0 
@mcp-b/webmcp-local-relay | 5.1.0    | 6.0.0 
@mcp-b/webmcp-polyfill    | 5.1.0    | 6.0.0 
react                     | 19.2.8   | 19.3.0
react-dom                 | 19.2.8   | 19.3.0
react-is                  | 19.2.8   | 19.3.0

## Current
Package       | Resolved | Latest
------------- | -------- | ------
dompurify (3) | 3.4.16   | 3.4.16
htm           | 3.1.1    | 3.1.1 
marked (18)   | 18.1.0   | 18.1.0
react-select  | 5.10.2   | 5.10.2

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[MiguelsPizza]

I ran web-agents against 6.0.1 for the three @MCP-B packages. Bumping the import map alone breaks the page: the polyfill's initializeWebMCPPolyfill export is gone. Three small code changes fix it:

• index.html: import { installWebMCP } from "@mcp-b/webmcp-polyfill"; installWebMCP();
• tool-registry.js: navigator.modelContextTesting is gone. Look the tool up with document.modelContext.getTools() and call executeTool(tool, args), which takes an object and resolves to a JSON string.
• platform.js: drop the navigator.modelContext fallback; __isWebMCPPolyfill no longer exists.

vector-search-web needs the same changes. With both on 6.0.1, the notepad and search tools and the local relay worked in Chrome 154 (polyfill) and 156 (native). One behavior change: the relay also exposes the same-origin iframe's search tool. Happy to share the diffs.

[ryan-roemer]

Thanks for keeping an eye here @MiguelsPizza!

Yeah, would appreciate any diffs if you have 'em. I'm going to be demoing both next week at AGNTCon. I was going to wait until after the conference to update, but if they're pretty straightforward, I'll tackle them now...

Are you going to AGNTCon?

[ryan-roemer]

OK, got everything working with updated deps in vector-search-web and web-agents.

Thanks for the 6.0.1 notes, @MiguelsPizza -- the tips were great.

One wrinkle I hit in case it's useful: I was on Chrome 154 with the "WebMCP for testing" flag on, and the relay widget skipped the search tool for vector-search-web:

    [webmcp-relay-widget] Tool "search_nearform_knowledge" was not relayed because its input schema is malformed.

On 154, native getTools() hands back inputSchema as a JSON string, not an object:

(await document.modelContext.getTools()).map((t) => [t.name, typeof t.inputSchema])
// => [["search_nearform_knowledge", "string"]]

The widget only relays an object schema, so a string gets dropped. The polyfill parses it back to an object, which is why 154 without the flag works fine (and lines up with your 154 polyfill run). Updating to 155 fixed it for me, flag still on.

I ended up adding a console warning to both apps that names the skipped tools and suggests updating Chrome or turning the flag off. Not sure if the embed widget could have an option to manually smooth that over by patching the schema/tools (or if you'd even want to), but figured I'd mention it.

[MiguelsPizza]

Thanks @ryan-roemer, good catch on 154.

@mcp-b/webmcp-local-relay@6.0.2 now says why it skips a tool when native WebMCP predates Chrome 155: update Chrome, or turn off the WebMCP testing flag to use the polyfill. It used to call the schema malformed.

We left out a shim on purpose. Before 155, native executeTool also wants string input, so patching the schema would list the tool but every call would still fail. Chrome 155 is the first release with object input, and that's the floor for the native lane.

[MiguelsPizza]

Are you going to AGNTCon?

@ryan-roemer , Unfortunately not, but I'll catch your talk when it's posted online. Good luck!

(Sorry, I did not realize my agent responded above..)